Precedent corpus / ICO (United Kingdom)
Capita plc and Capita Pension Services Limited
ICO (United Kingdom) case capita-2025-10, decided . GBP 14M.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
What the regulator decided
In March 2023 a ransomware actor obtained access to Capita's corporate environment via a malware-bearing download on a Capita employee laptop and exfiltrated personal data of approximately 6.6 million people, including pension members of 325 client schemes; Capita had been aware of the underlying vulnerabilities, did not treat the early indicators as a security incident, and lacked adequate technical and organisational measures, breaching Article 5(1)(f) and Article 32 UK GDPR.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://ico.org.uk/media2/pv5nhks4/capita-plc-and-cpsl-monetary-penalty-notice.pdfConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
Fine split: GBP 8M against Capita plc as controller + GBP 6M against Capita Pension Services Limited as processor. The initial starting point was GBP 58M; settlement-and-no-appeal plus group-double- punishment adjustments reduced the final to GBP 14M. Cite as a recent precedent that the ICO will fine a processor directly under Article 32, not only the controller.
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-ico-capita-2025-10,
author = {{ConsentMark}},
year = {2025},
title = {ICO (United Kingdom) capita-2025-10 - Capita plc and Capita Pension Services Limited},
howpublished = {\url{https://www.consentmark.com/precedent/ico-capita-2025-10}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2025, October 15). ICO (United Kingdom) capita-2025-10 - Capita plc and Capita Pension Services Limited. Methodology v7.8.1. https://www.consentmark.com/precedent/ico-capita-2025-10[ICO (United Kingdom) capita-2025-10 - Capita plc and Capita Pension Services Limited - ConsentMark](https://www.consentmark.com/precedent/ico-capita-2025-10)ICO (United Kingdom) capita-2025-10 - Capita plc and Capita Pension Services Limited - ConsentMark, 2025-10-15, methodology v7.8.1, https://www.consentmark.com/precedent/ico-capita-2025-10